CVE-2017-18158

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Possible buffer overflows and array out of bounds accesses in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05 while flashing images.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Android for MSM, Firefox OS for MSM, QRD Android	All Android releases from CAF using the Linux kernel

References

Timeline

Published: Jul 6, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-181597.8In Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-0 CVE-2017-181609.8AGPS session failure in GNSS module due to cyphersuites are hardcoded and needed manual update everytime in snapdragon mobile and snapdragon CVE-2017-181695.5User process can perform the kernel DOS in ashmem when doing cache maintenance operation in all Android releases(Android for MSM, Firefox OS CVE-2017-181708.8Improper input validation in Bluetooth Controller function can lead to possible memory corruption in Snapdragon Mobile in version QCA9379, S CVE-2017-181718.8Improper input validation for GATT data packet received in Bluetooth Controller function can lead to possible memory corruption in Snapdrago CVE-2017-181727.8In a device, with screen size 1440x2560, the check of contiguous buffer will overflow on certain buffer size resulting in an Integer Overflo CVE-2017-181737.8In case of using an invalid android verified boot signature with very large length, an integer underflow occurs in Snapdragon Mobile in SD 4 CVE-2017-181749.8In the Linux kernel before 4.7, the amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls the pinctrl_unregister function, leading CVE-2017-181755.4Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfiguration), as demonstrated by the src at CVE-2017-181765.4Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application's own code. CVE-2017-181775.4Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is fixed in 10.1.CVE-2017-181786.1Authenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication token is sent to the redirection target, i